Open the machine → Firewall tab.
How firewall groups work
A firewall group is a reusable set of rules that you attach to one or more machines in the same project. Write the rules once, apply them to every web server you own; edit the group later and every attached machine picks up the change.
Each rule has:
| Field | Values | Notes |
|---|---|---|
| Direction | Incoming / Outgoing | Incoming rules allow traffic to your server, outgoing rules restrict traffic from it |
| Protocol | TCP, UDP, ICMP, GRE | ICMP is what makes your server answer ping |
| Port | 80, 443, or a range like 8000-9000 | Not used for ICMP/GRE |
| Source / Destination | CIDR, e.g. 0.0.0.0/0 | Empty means any address |
Default policies
The defaults are the important part, and they are not symmetric:
- Incoming: DROP. Anything you don't explicitly allow is blocked. If there are no incoming rules at all, all inbound traffic is blocked.
- Outgoing: ACCEPT. Anything you don't explicitly restrict is allowed. If there are no outgoing rules, all outbound traffic is permitted.
So the practical work is adding one incoming rule per service you expose: TCP 22 for SSH, TCP 80 and 443 for a website, and so on.
WarningAlways keep an incoming rule for SSH (TCP 22) or RDP (TCP 3389) before you apply a group, or you'll lock yourself out. If it happens, the browser console still works: it doesn't go through the firewall.
Apply the rules
Click Groups, tick the groups you want on this machine (you can also create a new one from the same list) and click Apply changes. The status badge shows Applying and then Active. Rules take effect live, with no reboot and no dropped connections beyond the ones you just blocked. To take a group off, use the remove icon on its row and apply again; leaving the machine with no groups turns its firewall off, and the panel asks you to confirm.
Each attached group is listed with its rules. To see how many machines share a group before you edit it, open it from the Firewall page: clicking a group shows its rules and how many VPS and Bare Metal servers use it.
What this firewall does not do
ImportantThis firewall filters packets at the machine. It cannot stop a volumetric DDoS attack: by the time the traffic reaches your server, the bandwidth is already consumed, and sustained flooding may cause us to null-route the machine to protect the rest of the network.
For attack traffic you need filtering further upstream: see DDoS Mitigation for Edge ACL rules and AntiDDoS Premium, which drop traffic at the network edge before it reaches you.
TipPrefer specific sources over
0.0.0.0/0wherever you can. Restricting SSH to your office or VPN range removes almost all brute-force noise from a server's logs.